Remote Server API

You can make a client application contact a server in IBM Security Directory Integrator. A client task can remotely invoke a server task. Learn more about this though the links and information provided here.

This section does not cover securing an instance of an IBM Security Directory Integrator Server; this is discussed in IBM Security Directory Integrator Server Instance Security. Instead, this section discusses how client applications can contact a server.

IBM Security Directory Integrator supports the concept of a Remote API (also known as just "Server API"), where client tasks can invoke tasks on a remote IBM Security Directory Integrator Server by means of an access layer called RMI.

Note: The "remote Server" could very well be running on the same computer as the client application, for example if you start up a Server instance on your local computer and then access it using the Remote API through the loopback address, 127.0.01. All concepts discussed below are still valid, even though the remote Server runs locally.

The Server API calls address the following areas:

Getting Server information
Getting information for components installed on the Server
Reading and writing to configuration(s) loaded by the Server
Loading new configurations into the Server
Starting, querying and stopping AssemblyLines
Cycling through AssemblyLines

Note: Increasing needs for remote server access for each running IBM Security Directory Integrator server have resulted in a change from local access by default to remote access by default. As of v7.1.1, the remote server API is enabled by default. Prior to v7.1.1, the server API was enabled only for local access by default, where local access means access from the same Java Runtime Environment (JRE). To ensure security, remote access requires SSL client authentication. SSL access using client authentication is provided with the sample keystore and truststore deployed with IBM Security Directory Integrator.

The Server API itself is documented in the IBM Security Directory Integrator Java API documentation (TDI_install_dir/docs/api; you can launch a browser to display this documentation by selecting Help -> Welcome -> JavaDocs in the CE). The package of interest in this context is com.ibm.di.api. Also see the section called "Using the Server API" under Reference section of the IBM Knowledge Center for IBM Security Directory Integrator.

The Configuration Editor uses the Remote API to talk to the server you use to test-run your solutions. If this IBM Security Directory Integrator server is running on the same machine, it is often called the "local development server". For setups where the deployment platform does not support the Configuration Editor, you can run the development server on the deployment server, and the Configuration Editor on a supported platform like Windows (this way of running we call the "Remote Configuration Editor"). This design provides a uniform interface for both remote and local Config files. For some aspects of the Configuration Editor talking to a remote deployment server, see Using the Remote Configuration Editor.

The Server API is configured through a set of server properties (see Configuring the Server API). These properties are specified in the global.properties configuration file of the IBM® Security Directory Integrator Server. Some of the properties, in turn, point to additional configuration files and keystore files.

The Server API provides a number of security-related features (which both IBM Security Directory Integrator Solution-based clients as well other client applications have to deal with). There are three aspects to Server API Access Security:

Server API SSL remote access (which secures the transport channel to a remote IBM Security Directory Integrator Server),
Server API authentication (which handles the client authentication to an IBM Security Directory Integrator Server),
Server API Authorization (which handles the client authorization to an IBM Security Directory Integrator Server, that is, what the client is allowed to do once authenticated).